A leaked chat and bitcoin trail show a US government entity paid Kairos $1m to suppress stolen files, no encryption involved, with clues pointing to Ohio.
JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.